Emergency Stop Failure on Aircraft Refueller: Why It Must Be Reported

Emergency stop failure on an aircraft refueller is not a minor operational issue. It is a safety-critical defect that must be reported, assessed, repaired, functionally verified, and documented before the vehicle is returned to service.

During this week’s ARC LinkedIn quiz, we asked a practical safety question for aviation refuelling operators, supervisors, maintenance teams, and fleet managers:

During a pre-use inspection, one of the emergency stop buttons on the refueller fails during the functional check. What should be done?

A. Continue operation because the deadman control is still working
B. Remove the equipment from service and report the defect
C. Continue operation and avoid using that emergency stop button

The correct answer is:

B — Remove the equipment from service and report the defect

This is the only acceptable answer.

If an emergency stop button does not operate correctly during a pre-use inspection or functional check, the refueller should not continue normal operation. The defect must be reported, assessed, repaired, functionally verified, and documented before the vehicle is returned to service.

An emergency stop is not a secondary convenience feature. It is a safety-critical function intended to support rapid shutdown when normal operation becomes unsafe. If that function is known to be defective, continuing operation weakens the refueller’s safety chain and introduces avoidable operational risk.

In aviation refuelling, the professional decision is simple: do not operate with a known failed safety-critical function, including a defective emergency stop.

Why Emergency Stop Failure Matters

Aircraft refuelling is a high-consequence operation. Fuel transfer takes place near aircraft, ramp personnel, ground support equipment, passengers, and ignition-sensitive areas. The operating environment is dynamic, and a normal refuelling activity can quickly become abnormal if there is a leak, spill, equipment malfunction, vehicle movement issue, hose failure, or fire risk.

In this environment, safety systems are not optional. They are part of the design and operating standards that ensure aircraft fuelling is done safely and consistently.

A refueller normally relies on several layers of control, including:

• trained and competent operators;
• pre-use inspections;
• deadman control;
• emergency stop or emergency fuelling stop functions;
• pressure control systems;
• interlocks;
• bonding and static control;
• hose and coupling integrity;
• fire safety equipment;
• fuel quality controls;
• maintenance and testing records.

The emergency stop system is one of the key safety barriers in this chain. It may not be used during normal operation, but it must be available when abnormal conditions occur.

A failed emergency stop button may not create an immediate visible problem during routine fuelling. The refueller may still start, move, pump, and meter fuel. However, the real issue is not whether the vehicle can still operate. The issue is whether the vehicle remains in the required operating safety condition.

ARC emphasised the urgency of the fuel shutdown in its article on Emergency Fuel Shutoff. The same logic applies to the quiz scenario: when a shutdown function is required, it must be reliable, accessible, and ready to operate.

An emergency stop failure during inspection is therefore not a minor observation. It is a clear indication that a critical safety function requires immediate attention.

Minimum Emergency Shut-Off Requirements on Refuellers

For aviation fuelling professionals, it is important to distinguish the overall concept of an emergency stop from the minimum design requirements for emergency shut-off on refuellers.

At a minimum, a refueller should be fitted with emergency shut-off controls that are available from both sides of the vehicle and accessible from outside the cab. For refuellers driven by an internal combustion engine, these are typically emergency engine/fuelling stop devices provided in addition to the normal engine stop in the driver’s cab.

These external controls are needed because the person responding during an abnormal condition may not be inside the cab. The operator may be at the control panel, near the hose, on the fuelling platform, or another trained person may need to respond from outside the vehicle.

Where a top deck or elevating fuelling platform is fitted, an additional emergency shut-off control should be provided and operable from that deck or platform, so the operator can respond immediately from the working position.

The external emergency shut-off controls should be clearly identified, permanently and legibly marked, accessible from ground level, and located away from fill openings and discharge outlets. They should be positioned so they can be operated quickly and are not made difficult to reach during a leak, spill, or abnormal event.

The function is also critical. The emergency shut-off system should stop fuel flow when activated. New mobile fuellers and hydrant dispensers put into service from January 2023 onwards should be fitted with emergency engine stops that also stop fuel flow. Older vehicles may have separate engine stop and fuel-flow stop controls; when this arrangement exists, each control should be clearly identified by its purpose.

Depending on the vehicle design, stopping fuel flow may be achieved by closing the outlet valve, stopping the engine, stopping the pump or independent power source, closing a fuel-control valve, closing a valve associated with the deadman system, or activating another defined shutdown function within the vehicle’s safety system.

For equipment without an internal combustion engine, such as electric refuelling equipment, hydrant carts, or trailer-mounted units, emergency fuelling stop devices should still be provided on both sides of the equipment.

The practical expectation is clear: emergency shut-off controls must be accessible, clearly identified, suitable for the vehicle design, and capable of stopping fuel flow when required.

Emergency Stop Test Frequency

A failed emergency stop button on an aircraft refueller must be reported, assessed, repaired, and verified before the equipment returns to operation.

Emergency stop systems must not only be installed; their function must also be tested, verified, and recorded. Emergency stop failure during a test means the safety function did not perform when required.

For into-plane fuelling equipment, the function of externally mounted emergency engine/fuelling stop systems should be checked at the defined routine frequency required by the applicable operating standard, company procedure, airport requirement, customer requirement, and OEM instruction.

Under JIG 1, the function of externally mounted emergency engine/fuelling stop systems shall be checked monthly.

Where more than one requirement applies, the operator should follow the most stringent applicable requirement. Local procedures, customer rules, airport requirements, or OEM instructions may also require emergency stops to be checked more frequently, including during pre-use inspection or before a refueller is released for operation.

This distinction matters.

A scheduled functional test confirms that the emergency stop system continues to perform as designed at the required routine interval. A pre-use inspection confirms that the equipment is serviceable before it enters live operation. If an emergency stop fails during either a scheduled functional test or a required pre-use check, the operational decision should be the same: the equipment should not be released for normal fuelling operation until the defect has been reported, assessed, corrected, functionally verified, and recorded.

A failed emergency stop test is not an administrative issue. It means the safety function did not perform when required.

Deadman Control and Emergency Stop Are Not the Same

One of the most common wrong assumptions is shown in option A:

“Continue operation because the deadman control is still working.”

This may sound reasonable at first, but it is incorrect from a safety-barrier perspective.

The deadman control is designed to allow fuel flow only while the operator maintains active control of the fuelling operation. If the operator releases the deadman, fuel flow should stop. It is an essential operational safety device during fuelling.

ARC has explained this function in detail in its article on Deadman Control in Aviation Refuelling, where the deadman system is presented as a key barrier for controlled fuel delivery.

However, the deadman does not replace the emergency stop.

The emergency stop has a different role. It is intended to provide rapid shutdown in abnormal or emergency conditions. Activating the emergency stop should stop fuel flow, either directly or through the designed shutdown logic of the refueller. Depending on the vehicle design, this may be achieved by stopping the engine, stopping the pump or an independent power source, closing a fuel-control valve, closing a valve associated with the deadman system, or activating another defined shutdown function within the vehicle’s safety system.

These two systems support safety in different ways:

The deadman control maintains active operator control during fuelling.
The emergency stop provides rapid shutdown capability during an abnormal or emergency situation.

A working deadman control does not make a failed emergency stop acceptable. Equally, a working interlock or pressure-control system does not compensate for a defective emergency shutdown function.

Each safety barrier serves a specific purpose. If one safety-critical barrier fails, the vehicle is no longer in the expected condition for normal operation.

Why “Avoid Using That Button” Is Not Acceptable

Option C — continuing operation and avoiding the defective emergency stop button — is also incorrect.

This approach treats the emergency stop button as a normal control that can simply be avoided. In reality, emergency stop buttons exist for situations where rapid response may be needed.

During an emergency, there should be no reliance on memory, workaround instructions, or informal communication about which emergency stop is defective. The person who needs to respond may not be the same operator who found the defect during the pre-use inspection. It may be another operator, supervisor, technician, airline or aircraft representative, or other ramp personnel.

Noise, urgency, low visibility, aircraft turnaround pressure, vehicle movement, and ramp congestion can all reduce response time. In such conditions, a known defective emergency stop is not an acceptable risk.

A defective emergency stop button can also indicate more than a local button fault. The failure may involve:

• the button mechanism;
• electrical contacts;
• wiring;
• relays;
• control logic;
• pneumatic or electrical shutdown components;
• reset behaviour;
• corrosion or water ingress;
• vibration damage;
• previous repair quality;
• aging components.

Until the defect is assessed, the reliability of the wider emergency stop circuit is uncertain.

The correct action is not to work around the failed button. The correct action is to remove the equipment from service, report the defect, and arrange a technical assessment.

Emergency Stop Systems Are Part of the Safety-Barrier Chain

In aircraft refuelling, safety is built through layers. Normal operation depends on procedures, competent personnel, equipment design, inspections, preventive maintenance, and functional testing.

Emergency stop systems are different because they are designed for abnormal conditions. They may be needed when:

• fuel flow must be stopped quickly;
• a leak or spill occurs;
• fire risk develops;
• equipment malfunction is observed;
• the operator loses control of the operation;
• a hose, coupling, or control issue develops;
• another person notices an unsafe condition;
• normal controls are not sufficient or not immediately accessible.

This is why emergency stop functionality must be treated seriously. It is not enough that the refueller can still pump fuel. It is not enough that another emergency stop button may still work. It is not enough for the operator to know which button failed.

The system must be serviceable before the refueller enters operation.

The Purpose of the Pre-Use Inspection

A pre-use inspection is not only a checklist. It is a safety decision point before the refueller enters live operation.

The purpose is to confirm that the vehicle is serviceable and ready to operate safely before it is driven to the aircraft stand or connected for fuelling. Depending on the operator’s local procedure and vehicle design, these checks may include the condition of hoses, bonding, interlocks, emergency stops, controls, tyres, lights, fire extinguishers, leaks, warning systems, and other operational functions.

If an emergency stop failure is discovered at this stage, the inspection has done its job. The defect has been found before the vehicle reached the aircraft, before the hose was connected, and before fuel transfer began.

That is the best time to stop and control the risk. The risk begins only if the defect is ignored.

What Should Happen After an Emergency Stop Failure?

The exact response must always follow the operator’s local procedures, airport requirements, customer rules, OEM instructions, and applicable standards. However, the professional principle is clear:

Remove from service, report, assess, repair, verify, and document.

Once the failure is found, the refueller should not be released for normal operation. The defect should be reported immediately to the responsible supervisor, maintenance team, or control point.

The vehicle should be clearly identified as unavailable or unserviceable so that it is not used unintentionally. This is especially important in busy operations where several units may be moving between parking areas, loading points, workshops, and aircraft stands.

Maintenance should then assess whether the failure is limited to a single emergency stop button or affects the wider emergency stop circuit. This assessment should consider the button, wiring, contacts, electrical or pneumatic shutdown logic, reset behaviour, engine stop function, fuelling stop function, and any related control system.

If a defect is confirmed, the repair must restore the safety function, not only remove the visible symptom. After repair, the system should be functionally tested before returning to service. The release decision should be based on evidence, not assumptions.

The defect, corrective action, test result, and return-to-service decision should be documented. This supports traceability, maintenance planning, reliability analysis, and future fleet improvement.

Why Equipment Availability Must Not Override Safety

In busy aviation operations, there is always pressure to keep equipment available. A refueller out of service can affect fleet planning, stand support, maintenance workload, and turnaround flexibility.

However, equipment availability must never override a known safety-critical defect.

Continuing to operate a refueller with a failed emergency stop may appear to save time in the short term. In reality, it creates greater exposure if an emergency occurs. The consequences can include fuel interruption, vehicle downtime, safety reporting, customer escalations, aircraft delays, regulatory concerns, or incident investigation.

The better availability strategy is early removal, controlled repair, and verified return to service.

A controlled maintenance intervention before operation is always preferable to discovering a failed safety function during live aircraft fuelling.

This is where safety culture, equipment reliability, and lifecycle management meet. Strong operations do not wait for emergency systems to prove their failure during a real event. They act when defects are identified during inspection, before the equipment is exposed to the aircraft, the operator, and the wider ramp environment.

Maintenance Perspective: Emergency Stop Failure Can Reveal a Wider Issue

From a maintenance perspective, a failed emergency stop button is useful information. It may be a simple local component failure, but it may also reveal a wider reliability issue in the vehicle control system.

Possible causes may include damaged contacts, loose terminals, broken wiring, failed relays, pneumatic control issues, corrosion, moisture ingress, poor cable routing, vibration, damaged reset mechanisms, previous incorrect repair, or component aging.

The maintenance team should therefore not only restore the function but also understand why it failed.

If similar defects occur on the same vehicle or across the fleet, the issue may be related to component selection, environmental exposure, cleaning practices, operating conditions, wiring protection, maintenance intervals, or aging equipment. At that point, the defect becomes more than a single repair. It becomes a reliability and lifecycle management issue.

Aviation refuelling equipment must be maintained as an integrated system. Safety devices, emergency controls, deadman systems, interlocks, pressure control, hoses, filtration, metering, and monitoring systems all require inspection, testing, maintenance, and records.

This is the same operational logic applied in ARC’s article on Small Fuel Leak on Aircraft Refueller: a defect found during inspection should not be normalised or carried into live operation. It should be reported, assessed, corrected where required, and verified before the equipment is returned to service.

What This Means for Operators, Supervisors, and Fleet Managers

For operators, the lesson is practical: do not accept a failed emergency stop as a minor defect. Report it immediately and do not use the vehicle until the condition is assessed.

For supervisors, the lesson is procedural: defect reporting must be clear, fast, and supported by a culture that does not pressure operators to continue with known safety-system failures.

For maintenance teams, the lesson is technical: repair the failed function, confirm whether the fault is isolated or systemic, and verify the complete safety function before release.

For fleet managers, the lesson is strategic: recurring emergency stop defects should be tracked as reliability indicators. They may identify aging equipment, weak maintenance intervals, component exposure, or areas where refurbishment or system improvement is needed.

For customers and airport stakeholders, the lesson is operational: safe aircraft refuelling depends not only on written procedures but also on the verified condition of the equipment used to deliver fuel.

The Lesson From the Quiz

The correct answer to the quiz is not simply a maintenance instruction. It reflects the safety culture expected in aviation fuelling operations.

A failed emergency stop button is not something to work around. It is not acceptable to continue because the deadman control is working. It is not acceptable to avoid that button and use another one. It is not acceptable to delay the report until the end of the shift.

The correct response is:

• Remove the equipment from service.
• Report the defect.
• Arrange maintenance assessment.
• Repair the safety function.
• Verify correct operation.
• Record the return-to-service decision.

This protects the operator, the aircraft, the refuelling vehicle, the customer, and the airport operation.

Conclusion: Emergency Stop Failure Means Do Not Operate

Emergency stop systems are critical safety barriers on aircraft refuellers. If one emergency stop button fails during a pre-use inspection, the vehicle must not continue normal operation until the defect has been reported, assessed, corrected, and verified.

The deadman control is important, but it does not replace the emergency stop system. Avoiding the defective button is not a control measure. A known failed emergency stop function means the equipment is not in the expected safety condition for operation.

In aviation fuelling, safety depends on disciplined decisions before the operation begins. When a defect is found during inspection, the safest and most professional action is to act immediately.

At ARC NV, inspection, maintenance, repairs, spare parts supply, refurbishment, and lifecycle support are part of keeping aviation refuelling equipment safe, reliable, and ready for operation.

Contact Us

If your operation is facing recurring safety-system defects, emergency stop failures, interlock issues, hydraulic problems, or increasing refueller downtime, ARC NV can support with inspection, maintenance, refurbishment, spare parts, and lifecycle evaluation.

Contact us to discuss how we can help keep your aviation refuelling equipment safe, reliable, compliant, and ready for operation.

Contact ARC NV
Email: question@arc-refuellers.be
Telephone: +32 3 844 55 68